main: unable to connect to host: Connection timed out (110)

[Robert Van Overmeiren]

I can run vncserver, and test locally with vncviewer 10.3.1.194:1. From
a port forward configured SSH gateway, I can connect with vncviewer to
an associates box, but connection to my box times out. I think there's a
problem with SSH keys.

I was advised to upgrade to 4.2.1, which I did in /usr/local/bin/. I got
'libstdc ... No such file or directory' so did yum install
libstdc++-libc6.2-2.so.3. Then I got '/usr/bin/xsetroot: unable to open
display' so uncommented the font path section in vncserver and changed
'lib' to 'shared' in the paths. I didn't know how to check that the
patches were applied, but am not so concerned with VNC version as I am
with the connection time out problem.

I use Eclipse IDE and was given an eclipse font style file (.gtkrc-2.0)
to add to my home directory, so thought maybe I can't remote VNC because
the remote VNC server can't render the font.

With my upgraded VNC working, I can again connect locally with
vncviewer, but not from the SSH gateway. I tried it without Eclipse
running, but makes no difference.

I don't see the connection attempt in the vncserver log. Where can I get
more info? What log on the SSH gateway can I look at. There's no VNC log
on the gateway, should there be? I can't view logs in /root/.vnc/.

-----Original Message-----
From: vnc-list-***@realvnc.com [mailto:vnc-list-***@realvnc.com] On
Behalf Of William Hooper
Sent: Friday, August 11, 2006 5:27 AM
To: vnc-***@realvnc.com
Subject: Re: Connection not allowed to own service freedesktop due to
security policies

maybe you could try yum libstdc++ ????
More than a little secure ......
You need to find out from someone at fedora if they fixed the 411
rremote access bug; which is ENTIRELY NASTY IF EXPLOITED [the bad guys

will

own your machine(s)] then you won't have to update
but.......................

You can just look at the RPM changelog to see it was fixed.

* Fri May 26 2006 Jitka Kudrnacova <***@redhat.com> 4.1.1-39.fc5
- enable OpenGL by default

* Wed May 17 2006 Jitka Kudrnacova <***@redhat.com> 4.1.1-38.fc5
- really fixed authentication

* Tue May 16 2006 Jitka Kudrnacova <***@redhat.com> 4.1.1-37.fc5
- Fixed authentication (bug #191692), upstream patch

[William Hooper]

Post by Robert Van Overmeiren
I can run vncserver, and test locally with vncviewer 10.3.1.194:1. From
a port forward configured SSH gateway, I can connect with vncviewer to an
associates box, but connection to my box times out. I think there's a
problem with SSH keys.

I highly doubt it since VNC doesn't use SSH keys.

Start with the basics. Copy and paste what commands you are using and
what output they are generating.

[William Hooper]

Please send replies to the VNC list.

$ vncserver (works OK)
Then, I test viewer from localhost
$ vncviewer :1 (works OK. I can get a textual or graphic desktop)

This tells you nothing of the status of any firewalls on 10.3.1.194, though.

$ vncviewer 10.3.1.78:1 (invokes the VNCauth box OK)
$ vncviewer 10.3.1.194:1 (connection times out)

I assume this is after you have used SSH to connect to the gateway machine?

If I knew what log to view, I might find why its not working. I know
port forwarding is working

None of your examples use port forwarding, only a remote X tunnel from SSH.

and I doubt the admins are blocking my specific
IP.

Is there a firewall on your machine blocking connections, though. Another
troubleshooting step would be to use telnet to verify you can connect to
the machine:

$ telnet 10.3.1.194 5901

And see if you get a response.

[Robert Van Overmeiren]

Post by William Hooper
status of any firewalls on 10.3.1.194

Its just a Fedora/Gnome workstation. I haven't setup any firewalls. How
would I check this? I've seen this in the logs, maybe there's an x
session authorization issue?

Authentication Rejected, reason : None of the authentication protocols
specified are supported and host-based authentication failed.

Post by William Hooper
(connection times out) I assume this is after you have used SSH to

connect to the gateway machine?

Yes

Post by William Hooper
None of your examples use port forwarding, only a remote X tunnel from

SSH.

I can invoke VNCauth on other systems from the SSH gateway, and I was
told that the tunneling was all I needed. The hardware is different, and
they may be running an older Fedora, so I guess the systems are too
different to compare.

I've seen had an example of a connection command with ports for
forwarding but can't find it. What command would work for my situation?



-----Original Message-----
From: vnc-list-***@realvnc.com [mailto:vnc-list-***@realvnc.com] On
Behalf Of William Hooper
Sent: Friday, August 11, 2006 11:10 AM
To: vnc-***@realvnc.com
Subject: RE: main: unable to connect to host: Connection timed out (110)

Please send replies to the VNC list.

Post by William Hooper
$ vncserver (works OK)
Then, I test viewer from localhost
$ vncviewer :1 (works OK. I can get a textual or graphic desktop)

This tells you nothing of the status of any firewalls on 10.3.1.194,
though.

Post by William Hooper
$ vncviewer 10.3.1.78:1 (invokes the VNCauth box OK)
$ vncviewer 10.3.1.194:1 (connection times out)

I assume this is after you have used SSH to connect to the gateway
machine?

Post by William Hooper
If I knew what log to view, I might find why its not working. I know
port forwarding is working

None of your examples use port forwarding, only a remote X tunnel from
SSH.

Post by William Hooper
and I doubt the admins are blocking my specific
IP.

Is there a firewall on your machine blocking connections, though.
Another
troubleshooting step would be to use telnet to verify you can connect to
the machine:

$ telnet 10.3.1.194 5901

And see if you get a response.

[Robert Van Overmeiren]

PS, when I tested telnet port 5901 from the SSH gateway to the
workstation, it also timed out. I can ping and SSH though. How do I open
up port 5901?

-----Original Message-----
From: Robert Van Overmeiren
Sent: Friday, August 11, 2006 12:42 PM
To: 'VNC-***@realvnc.com'
Subject: RE: main: unable to connect to host: Connection timed out (110)

Post by William Hooper
status of any firewalls on 10.3.1.194

Its just a Fedora/Gnome workstation. I haven't setup any firewalls. How
would I check this? I've seen this in the logs, maybe there's an x
session authorization issue?

Authentication Rejected, reason : None of the authentication protocols
specified are supported and host-based authentication failed.

Post by William Hooper
(connection times out) I assume this is after you have used SSH to

connect to the gateway machine?

Yes

Post by William Hooper
None of your examples use port forwarding, only a remote X tunnel from

SSH.

I can invoke VNCauth on other systems from the SSH gateway, and I was
told that the tunneling was all I needed. The hardware is different, and
they may be running an older Fedora, so I guess the systems are too
different to compare.

I've seen had an example of a connection command with ports for
forwarding but can't find it. What command would work for my situation?



-----Original Message-----
From: vnc-list-***@realvnc.com [mailto:vnc-list-***@realvnc.com] On
Behalf Of William Hooper
Sent: Friday, August 11, 2006 11:10 AM
To: vnc-***@realvnc.com
Subject: RE: main: unable to connect to host: Connection timed out (110)

Please send replies to the VNC list.

Post by William Hooper
$ vncserver (works OK)
Then, I test viewer from localhost
$ vncviewer :1 (works OK. I can get a textual or graphic desktop)

This tells you nothing of the status of any firewalls on 10.3.1.194,
though.

Post by William Hooper
$ vncviewer 10.3.1.78:1 (invokes the VNCauth box OK)
$ vncviewer 10.3.1.194:1 (connection times out)

I assume this is after you have used SSH to connect to the gateway
machine?

Post by William Hooper
If I knew what log to view, I might find why its not working. I know
port forwarding is working

None of your examples use port forwarding, only a remote X tunnel from
SSH.

Post by William Hooper
and I doubt the admins are blocking my specific
IP.

Is there a firewall on your machine blocking connections, though.
Another
troubleshooting step would be to use telnet to verify you can connect to
the machine:

$ telnet 10.3.1.194 5901

And see if you get a response.

[Robert Van Overmeiren]

I connected!

Logged into SSH gateway:

$ ssh -X ***@merrimack

Binded ports:

$ ssh -f -N -C -T -l rvanovermeiren -L5902:localhost:5901 10.3.1.194

Then vncviewer:

$ vncviewer [-shared] localhost:2

How do I unbind the ports?

Does the binding persist until I do?

Now I have to try connecting remotely using Cygwin openssh on Windoz XP.


-----Original Message-----
From: vnc-list-***@realvnc.com [mailto:vnc-list-***@realvnc.com] On
Behalf Of Robert Van Overmeiren
Sent: Friday, August 11, 2006 12:46 PM
To: VNC-***@realvnc.com
Subject: RE: main: unable to connect to host: Connection timed out (110)

PS, when I tested telnet port 5901 from the SSH gateway to the
workstation, it also timed out. I can ping and SSH though. How do I open
up port 5901?

-----Original Message-----
From: Robert Van Overmeiren
Sent: Friday, August 11, 2006 12:42 PM
To: 'VNC-***@realvnc.com'
Subject: RE: main: unable to connect to host: Connection timed out (110)

Post by William Hooper
status of any firewalls on 10.3.1.194

Its just a Fedora/Gnome workstation. I haven't setup any firewalls. How
would I check this? I've seen this in the logs, maybe there's an x
session authorization issue?

Authentication Rejected, reason : None of the authentication protocols
specified are supported and host-based authentication failed.

Post by William Hooper
(connection times out) I assume this is after you have used SSH to

connect to the gateway machine?

Yes

Post by William Hooper
None of your examples use port forwarding, only a remote X tunnel from

SSH.

I can invoke VNCauth on other systems from the SSH gateway, and I was
told that the tunneling was all I needed. The hardware is different, and
they may be running an older Fedora, so I guess the systems are too
different to compare.

I've seen had an example of a connection command with ports for
forwarding but can't find it. What command would work for my situation?



-----Original Message-----
From: vnc-list-***@realvnc.com [mailto:vnc-list-***@realvnc.com] On
Behalf Of William Hooper
Sent: Friday, August 11, 2006 11:10 AM
To: vnc-***@realvnc.com
Subject: RE: main: unable to connect to host: Connection timed out (110)

Please send replies to the VNC list.

Post by William Hooper
$ vncserver (works OK)
Then, I test viewer from localhost
$ vncviewer :1 (works OK. I can get a textual or graphic desktop)

This tells you nothing of the status of any firewalls on 10.3.1.194,
though.

Post by William Hooper
$ vncviewer 10.3.1.78:1 (invokes the VNCauth box OK)
$ vncviewer 10.3.1.194:1 (connection times out)

I assume this is after you have used SSH to connect to the gateway
machine?

Post by William Hooper
If I knew what log to view, I might find why its not working. I know
port forwarding is working

None of your examples use port forwarding, only a remote X tunnel from
SSH.

Post by William Hooper
and I doubt the admins are blocking my specific
IP.

Is there a firewall on your machine blocking connections, though.
Another
troubleshooting step would be to use telnet to verify you can connect to
the machine:

$ telnet 10.3.1.194 5901

And see if you get a response.

[William Hooper]

Post by Robert Van Overmeiren
I connected!

Not "binded", tunneled.

Post by Robert Van Overmeiren
$ ssh -f -N -C -T -l rvanovermeiren -L5902:localhost:5901 10.3.1.194

Notice that this is using the SSH port for communication. That is why it
works when connecting directly to the VNC server doesn't.

Post by Robert Van Overmeiren
$ vncviewer [-shared] localhost:2
How do I unbind the ports?

You close the tunnel by closing the SSH connection.

[William Hooper]

Post by Robert Van Overmeiren

Post by William Hooper
status of any firewalls on 10.3.1.194

Its just a Fedora/Gnome workstation. I haven't setup any firewalls.

The firewall is on by default. Did you disable it during installation?

Post by Robert Van Overmeiren
How
would I check this?

/sbin/service iptables status

Post by Robert Van Overmeiren
I've seen this in the logs, maybe there's an x session
authorization issue?

If you can connect to the VNC server fine from the local machine, but not
the network then it is a network issue.

[snip]

Post by Robert Van Overmeiren

Post by William Hooper
None of your examples use port forwarding, only a remote X tunnel from

SSH.
I can invoke VNCauth on other systems from the SSH gateway,

Which leads us to believe the problem is communication with that specific
machine.

Post by Robert Van Overmeiren
and I was
told that the tunneling was all I needed.

You aren't tunneling.

Post by Robert Van Overmeiren
The hardware is different, and
they may be running an older Fedora, so I guess the systems are too
different to compare.
I've seen had an example of a connection command with ports for
forwarding but can't find it. What command would work for my situation?

If the issue is a local firewall, the only tunneling that would work would
be:

a) create a tunnel on the gateway to SSH on the problem machine
b) create a tunnel (via the first tunnel) to VNC on the problem machine

Unless you need the traffic from the gateway to the VNC machine encrypted,
it would be easier to fix this issue then just use one tunnel from the
gateway to the VNC server.

http://www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/sshvnc.html

[Robert Van Overmeiren]

Post by William Hooper
/sbin/service iptables status

Firewall is not configured.

Post by William Hooper
problem is communication with that specific machine.

Yes, I thought so.

Post by William Hooper
a) create a tunnel on the gateway to SSH on the problem machine
b) create a tunnel (via the first tunnel) to VNC on the problem

machine

That might be what I did with the SSH command in my other posting

ssh -f -N -C -T -l rvanovermeiren -L5902:localhost:5901 10.3.1.194

Post by William Hooper
Not "binded", tunneled.

When I run the command again, it returns 'bind: Address already in use',
so I thought I was binding ports to addresses.

Post by William Hooper
Notice that this is using the SSH port for communication. That is why

it works when connecting directly to the VNC server doesn't.

Yes, so my box doesn't allow external connections for telnet or VNC.

Post by William Hooper
You close the tunnel by closing the SSH connection.

I can close my connection to the SSH gateway, but the tunneling
connection stays there, and I can re-VNC. I guess I need to get the proc
ID then kill it?

[Robert Van Overmeiren]

I executed 'iptables stop' and now the port is open.

Thx for setting me straight :)

-----Original Message-----
From: Robert Van Overmeiren
Sent: Friday, August 11, 2006 1:45 PM
To: 'VNC-***@realvnc.com'
Subject: RE: main: unable to connect to host: Connection timed out (110)

Post by William Hooper
/sbin/service iptables status

Firewall is not configured.